CTO: work DEVEL.md when setting up a new dev machine, and feed back what it is missing nf-ij5w ← Beads

Twinned from https://github.com/cfsh/ninefold/issues/590 by tools/beads/import_github.py's reconcile pass.

Requested by @aedanpope in chat:

> then file an issue asking CTO to check Devel when setting up a new dev machine

The ask

When provisioning a new dev machine or worktree, work DEVEL.md and confirm each item — then, if the box taught you something the doc doesn't say, add it back. The doc is the checklist and the memory; a box set up from tribal knowledge leaves the next one to rediscover the same traps.

Why this is worth an issue rather than an assumption

The Linux gating host was provisioned today and reached a green dotnet build and three passing presubmit lanes — genuinely good. What it did *not* have, and what nothing failed loudly about:

• no reviewer App key, so the box could not run a review at all;
• no ~/agents/ninefold-reviewer clone, the second requirement for the same thing;
• ~/.ninefold-reviewer/logs/ present with no dispatcher, which made every poll on that box report a permanent, unclearable ⚠ STALE-DISPATCH — the alarm CLAUDE.md ranks above everything and which pins the cron at 30m. Same symptom the WSL office box has had (#560).

None of those is a provisioning mistake, because none of them was written down. That is the gap this issue is about. DEVEL.md now covers them (#589), and its new framing is the point:

> A machine is not "set up" when the build goes green. An agent session on it also needs gh authenticated as the bot, a Claude Code permission mode, and — if you want reviews to run there — the reviewer's App key. Those are the steps that get missed, because nothing fails loudly without them; they just quietly do less.

Suggested shape

1. Run ./presubmit.py --doctor first and work its list — it names each missing build-tier prerequisite and the fix.
2. Then work DEVEL.md's non-toolchain sections, which are the ones --doctor cannot see: bot auth, permission mode, reviewer credentials, the gotchas list.
3. Feed back what you learn. If a box needed a step the doc doesn't have, that is a DEVEL.md PR, not a note in a handover. The three items above were all discoverable only by hitting them.

Worth deciding, not assumed

• Does every new dev box get the reviewer key? #582 asks this and Aedan answered yes (option B) for this box. Whether that is the standing default for *every* future box, or a per-box call, is a CTO decision — the key is the ability to post as ninefold-reviewer[bot], and it currently spreads by hand.
• --doctor could absorb some of this. It already checks the build tier; the reviewer credential, the ~/agents clone, and the "no dispatcher but a state dir" trap are all mechanically checkable. That would move items from a doc nobody re-reads into a command everybody runs. Filed as a thought, not a request — it is a different piece of work and wants its own issue if it is wanted.

Filed unclaimed, per the request. Refs #589, #582, #560.